Add a load_status callback hook that is invoked at the end of chrome LoadApp.

src/trusted/service_runtime/sel_main_chrome.c

Index: src/trusted/service_runtime/sel_main_chrome.c
diff --git a/src/trusted/service_runtime/sel_main_chrome.c b/src/trusted/service_runtime/sel_main_chrome.c
index c4a013e802cdde0a7cab5e50c098101ee0fa0ff3..6c3d304f1967236879537367a812c0a2f723f6fa 100644
--- a/src/trusted/service_runtime/sel_main_chrome.c
+++ b/src/trusted/service_runtime/sel_main_chrome.c
@@ -107,6 +107,7 @@ struct NaClChromeMainArgs *NaClChromeMainArgsCreate(void) {
   args->broker_duplicate_handle_func = NULL;
   args->attach_debug_exception_handler_func = NULL;
 #endif
+  args->load_status_handler_func = NULL;
 #if NACL_LINUX || NACL_OSX
   args->number_of_cores = -1;  /* unknown */
 #endif
@@ -371,12 +372,41 @@ static int LoadApp(struct NaClApp *nap, struct NaClChromeMainArgs *args) {
 #endif
   }
 
+  if (args->load_status_handler_func != NULL) {
+    args->load_status_handler_func(LOAD_OK);
+  }
   return LOAD_OK;
 
 done:
   fflush(stdout);
 
   /*
+   * If there is a load status callback, call that now and transfer logs
+   * in preparation for process exit.
+   */
+  if (args->load_status_handler_func != NULL) {
+    /* Don't return LOAD_OK if we had some failure loading. */
+    if (LOAD_OK == errcode) {
+      errcode = LOAD_INTERNAL;
+    }
+    args->load_status_handler_func(errcode);
+    NaClLog(LOG_ERROR, "NaCl LoadApp failed. Transferring logs before exit.\n");
+    NaClLogRunAbortBehavior();
+    /*
+     * Fall through and run NaClBlockIfCommandChannelExists.
+     * TODO(jvoung): remove NaClBlockIfCommandChannelExists() and use the
+     * callback to indicate the load_status after Chromium no longer calls
+     * start_module. We also need to change Chromium so that it does not
+     * attempt to set up the command channel if there is a known load error.
+     * Otherwise there is a race between this process's exit / load error
+     * reporting, and the command channel setup on the Chromium side (plus
+     * the associated reporting). Thus this could end up with two different
+     * load errors being reported (1) the real load error from here, and
+     * (2) the command channel setup failure because the process exited in
+     * the middle of setting up the command channel.
+     */
+  }
+  /*
    * If there is a secure command channel, we sent an RPC reply with
    * the reason that the nexe was rejected.  If we exit now, that
    * reply may still be in-flight and the various channel closure (esp